X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/e67b06b7067c55f12bbdf72c5f9f00dec11e99fd..b44e523300b3fbe0a5d9b3081aaa588be3095b14:/client/cmdlfem4x.c diff --git a/client/cmdlfem4x.c b/client/cmdlfem4x.c index 862f20bd..3c46d3b1 100644 --- a/client/cmdlfem4x.c +++ b/client/cmdlfem4x.c @@ -11,14 +11,19 @@ #include #include #include -//#include "proxusb.h" #include "proxmark3.h" #include "ui.h" #include "graph.h" +#include "cmdmain.h" #include "cmdparser.h" #include "cmddata.h" #include "cmdlf.h" #include "cmdlfem4x.h" +#include "util.h" +#include "data.h" +#define LF_TRACE_BUFF_SIZE 16000 + +char *global_em410xId; static int CmdHelp(const char *Cmd); @@ -35,6 +40,7 @@ int CmdEM410xRead(const char *Cmd) int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low; int parity[4]; char id[11]; + char id2[11]; int retested = 0; uint8_t BitStream[MAX_GRAPH_TRACE_LEN]; high = low = 0; @@ -101,6 +107,7 @@ retest: { /* Read another byte! */ sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3])); + sprintf(id2+rows, "%x", (8 * BitStream[i+3]) + (4 * BitStream[i+2]) + (2 * BitStream[i+1]) + (1 * BitStream[i])); rows++; /* Keep parity info */ @@ -135,7 +142,10 @@ retest: { /* Sweet! */ PrintAndLog("EM410x Tag ID: %s", id); + PrintAndLog("Unique Tag ID: %s", id2); + global_em410xId = id; + /* Stop any loops */ return 1; } @@ -164,8 +174,9 @@ retest: } /* if we've already retested after flipping bits, return */ - if (retested++) + if (retested++){ return 0; + } /* if this didn't work, try flipping bits */ for (i = 0; i < bit2idx; i++) @@ -249,6 +260,7 @@ int CmdEM410xSim(const char *Cmd) int CmdEM410xWatch(const char *Cmd) { int read_h = (*Cmd == 'h'); + //char k; do { CmdLFRead(read_h ? "h" : ""); @@ -257,8 +269,26 @@ int CmdEM410xWatch(const char *Cmd) // is very slow // TBD: Auto-grow sample size based on detected sample rate. IE: If the // rate gets lower, then grow the number of samples - CmdSamples("4000"); - } while ( ! CmdEM410xRead("")); + + // Changed by martin, 4000 x 4 = 16000, + // see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235 + CmdSamples("16000"); + } while ( + !CmdEM410xRead("") + ); + return 0; +} + +int CmdEM410xWatchnSpoof(const char *Cmd) +{ + int read_h = (*Cmd == 'h'); + do + { + CmdLFRead(read_h ? "h" : ""); + CmdSamples("16000"); + } while ( ! CmdEM410xRead("")); + PrintAndLog("# Replaying : %s",global_em410xId); + CmdEM410xSim(global_em410xId); return 0; } @@ -409,7 +439,7 @@ int CmdEM4x50Read(const char *Cmd) int CmdEM410xWrite(const char *Cmd) { uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value - unsigned int card = 0xFF; // invalid card value + int card = 0xFF; // invalid card value unsigned int clock = 0; // invalid clock value sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock); @@ -476,48 +506,97 @@ int CmdEM410xWrite(const char *Cmd) int CmdReadWord(const char *Cmd) { - int Word = 16; //default to invalid word - UsbCommand c; + int Word = -1; //default to invalid word + UsbCommand c; - sscanf(Cmd, "%d", &Word); + sscanf(Cmd, "%d", &Word); - if (Word > 15) { - PrintAndLog("Word must be between 0 and 15"); - return 1; - } + if ( (Word > 15) | (Word < 0) ) { + PrintAndLog("Word must be between 0 and 15"); + return 1; + } - PrintAndLog("Reading word %d", Word); + PrintAndLog("Reading word %d", Word); - c.cmd = CMD_EM4X_READ_WORD; - c.d.asBytes[0] = 0x0; //Normal mode - c.arg[0] = 0; - c.arg[1] = Word; - c.arg[2] = 0; - SendCommand(&c); + c.cmd = CMD_EM4X_READ_WORD; + c.d.asBytes[0] = 0x0; //Normal mode + c.arg[0] = 0; + c.arg[1] = Word; + c.arg[2] = 0; + SendCommand(&c); + WaitForResponse(CMD_ACK, NULL); + + uint8_t data[LF_TRACE_BUFF_SIZE]; + memset(data, 0x00, LF_TRACE_BUFF_SIZE); + + GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset.. + WaitForResponseTimeout(CMD_ACK,NULL, 1500); + + for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) { + GraphBuffer[j] = ((int)data[j]) - 128; + } + GraphTraceLen = LF_TRACE_BUFF_SIZE; + + // BiDirectional + //CmdDirectionalThreshold("70 -60"); + + // Askdemod + //Cmdaskdemod("1"); + + uint8_t bits[1000]; + uint8_t * bitstream = bits; + memset(bitstream, 0x00, sizeof(bits)); + + manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream); + return 0; } int CmdReadWordPWD(const char *Cmd) { - int Word = 16; //default to invalid word - int Password = 0xFFFFFFFF; //default to blank password - UsbCommand c; - - sscanf(Cmd, "%d %x", &Word, &Password); - - if (Word > 15) { - PrintAndLog("Word must be between 0 and 15"); - return 1; - } - - PrintAndLog("Reading word %d with password %08X", Word, Password); + int Word = -1; //default to invalid word + int Password = 0xFFFFFFFF; //default to blank password + UsbCommand c; + + sscanf(Cmd, "%d %x", &Word, &Password); + + if ( (Word > 15) | (Word < 0) ) { + PrintAndLog("Word must be between 0 and 15"); + return 1; + } - c.cmd = CMD_EM4X_READ_WORD; - c.d.asBytes[0] = 0x1; //Password mode - c.arg[0] = 0; - c.arg[1] = Word; - c.arg[2] = Password; - SendCommand(&c); + PrintAndLog("Reading word %d with password %08X", Word, Password); + + c.cmd = CMD_EM4X_READ_WORD; + c.d.asBytes[0] = 0x1; //Password mode + c.arg[0] = 0; + c.arg[1] = Word; + c.arg[2] = Password; + SendCommand(&c); + WaitForResponse(CMD_ACK, NULL); + + uint8_t data[LF_TRACE_BUFF_SIZE]; + memset(data, 0x00, LF_TRACE_BUFF_SIZE); + + GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset.. + WaitForResponseTimeout(CMD_ACK,NULL, 1500); + + for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) { + GraphBuffer[j] = ((int)data[j]) - 128; + } + GraphTraceLen = LF_TRACE_BUFF_SIZE; + + // BiDirectional + //CmdDirectionalThreshold("70 -60"); + + // Askdemod + //Cmdaskdemod("1"); + + uint8_t bits[1000]; + uint8_t * bitstream = bits; + memset(bitstream, 0x00, sizeof(bits)); + + manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream); return 0; } @@ -570,20 +649,19 @@ int CmdWriteWordPWD(const char *Cmd) return 0; } - - static command_t CommandTable[] = { {"help", CmdHelp, 1, "This help"}, - {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"}, - {"em410xsim", CmdEM410xSim, 0, " -- Simulate EM410x tag"}, - {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"}, - {"em410xwrite", CmdEM410xWrite, 1, " <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"}, - {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"}, - {"readword", CmdReadWord, 1, " -- Read EM4xxx word data"}, - {"readwordPWD", CmdReadWordPWD, 1, " -- Read EM4xxx word data in password mode"}, - {"writeword", CmdWriteWord, 1, " -- Write EM4xxx word data"}, - {"writewordPWD", CmdWriteWordPWD, 1, " -- Write EM4xxx word data in password mode"}, + {"410read", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"}, + {"410sim", CmdEM410xSim, 0, " -- Simulate EM410x tag"}, + {"410watch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"}, + {"410spoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" }, + {"410write", CmdEM410xWrite, 1, " <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"}, + {"4xread", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"}, + {"rd", CmdReadWord, 1, " -- Read EM4xxx word data"}, + {"rdpwd", CmdReadWordPWD, 1, " -- Read EM4xxx word data in password mode "}, + {"wr", CmdWriteWord, 1, " -- Write EM4xxx word data"}, + {"wrpwd", CmdWriteWordPWD, 1, " -- Write EM4xxx word data in password mode"}, {NULL, NULL, 0, NULL} };